Rob Quiros

Conf42: Incident Management 2024

A New Architecture to Free Incident Responders from False Positives

Security tools base detection on "protect the conduit to protect the data inside". But can we trust correlation between APIs and data? High false positive rates that are killing SOC teams. A new approach is presented that avoids correlation to maximize real incident to false positive ratio.